Module 4 — Management, governance, and observability
Place in the route
Finish AZ-900 with the tools that operate the control plane and the controls that keep a workload understandable, compliant, and within budget.
Outcomes
You should be able to distinguish portal, CLI, PowerShell, Cloud Shell, ARM templates, and infrastructure as code; explain the boundary between RBAC, Policy, locks, and tags; and distinguish cost, health, metrics, logs, alerts, and application telemetry.
Management and governance
The Azure portal is a graphical control-plane client. Azure CLI and Azure PowerShell are scriptable clients. Cloud Shell supplies a browser-accessible shell with Azure tools. ARM templates and other infrastructure-as-code approaches describe desired resources so a change can be reviewed and repeated. These tools invoke management APIs; they do not bypass authorization.
Microsoft Entra ID authenticates a principal. Azure RBAC authorizes allowed Azure actions at a scope. Azure Policy evaluates resource configuration against governance rules and can audit or deny it. A resource lock protects management operations such as deletion but is not a complete data-plane backup. Tags classify resources for ownership and cost reporting; they do not enforce a rule by themselves.
Cost and signals
The pricing calculator estimates a planned design; Cost Management shows actual and forecast spending; budgets alert when spending crosses a threshold but do not automatically make every service free or stop every charge. Azure Advisor offers recommendations. Service Health describes Azure incidents and planned maintenance relevant to a subscription. Azure Monitor gathers platform and application signals: metrics are numeric time series, logs are event records queried in Log Analytics, and Application Insights adds application-focused telemetry. An alert rule evaluates a signal; an action group routes the notification or automation.
Conceptual checkpoint
Given a resource created in the wrong region, an unauthorized update, an untagged resource, and an application returning slow responses, choose the first control or signal to inspect and explain why Policy, RBAC, locks, tags, and Monitor solve different problems.
Hands-on / what to try
Translate one desired resource configuration into a portal checklist and an ARM/Bicep-style declaration, then list which observations would come from metrics, logs, traces, Service Health, and Advisor. Do not deploy it.
Sources and re-audit
- AZ-900 course, checked 2026-08-31.
- AZ-900 study guide, skills measured 2026-07-20, checked 2026-08-31.
- Azure Policy overview, checked 2026-08-31.
- Azure Monitor overview, checked 2026-08-31.
Re-audit when governance effects, management tools, cost behavior, or telemetry terminology changes.